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(57) ABSTRACT 

A 'virtual' encryption scheme combines selected ones of 
plurality of different encryption operators stored in an 
encryption operator database into a compound sequence of 
encryption operators. Data to be transported from a data 
source site, such as a user workstation, to a data recipient 
site, such as another workstation, is sequentially encrypted 
by performing a compound sequential data flow through this 
sequence prior to transmission. Because of the use of 
successively different encryption operators, the final output 
of the sequence will be a compound-encrypted data stream 
that has no readily discernible encryption footprint. 
Therefore, even if a skilled data communications usurper 
possesses a decryption key for each encryption operators, 
there is a very low likelihood that he would be able to 
recognize the characteristics of any individual encryption 
operator. Moreover, without knowledge of the sequence of 
encryption operators a potential usurper will be forced to 
operate under a severe resource penalty that makes decryp- 
tion of such a compound sequence a practical impossibility. 
At the recipient end of the data communications path, the 
recovery process involves the use of a complementary 
virtual decryption scheme that is the exact reverse of that 
used at the data source site. 

5 Claims, 3 Drawing Sheets 



UJf ENCRYPTED - 
11 L DATA 



DECRYPT KEY 



270 



230 



SUPERVISORY DECRYPTION 
MANAGER 



MEMORY ACCESS CONTROL 



ff 



^260 

|22(H|220-J|220-It|"- 



•DATA- 



-150 



DECOP-I OECOP-j 



220-1 



-200 



220-2- 
220-3- 



220-N- 



DECRYPTION OPERATOR 


DATABASE 


- ADD 


DECRYPT OP 


ADD 


DECRYPT OP 


ADD 


DECRYPT OP 






ADD 


DECRYPT OP 



^210-1 
-210-2 



DEC0P -k| •■ 
^240 



210-3 
210-N 



WORK STATION 



07/09/2003, EAST Version: 1.03.0002 



U.S. Patent May 15, 2001 Sheet 1 of 3 



US 6,233,338 Bl 




USER 
WORKSTATION 

20 



-22 



USER 
WORKSTATION 



MAIL GATEWAY 



25 



HUB 



LAN 
INTERFACE 



XT 



10 



13 



T 
11 



USER 
WORKSTATION 



-=Y"24 




LASER 
PRINTER 



-23 



FIG. 1 

PRIOR ART 



07/09/2003, EAST Version: 1.03.0002 



U.S. Patent May 15, 2001 Sheet 2 of 3 US 6,233,338 Bl 



ENCR. KEY 
■170 



r 



150 



-DATA.- 



130 



SUPERVISORY ENCRYPTION 
MANAGER 



MEMORY ACCESS CONTROL 



fr 



120-i 120-] 120-k 



160 



120-1 



120-2- 



120-N' 



ENCRYPTION OPERATOR 
DATABASE 


- ADD 


ENCRYPT OP 


ADD 


ENCRYPT OP 


ADD 


ENCRYPT OP 




* 


ADO 


ENCRYPT OP 



100 



-110-1 
-110-2 



COMPOUND- 
■ ENCRYPTED 
DATA 



TO 
LINE 
11 

KFIG.1) 



J 



V 



ENCOP-i ENCOP-i ENCOP-k 



110-3 
110-N 



140 



WORKSTATION 10 (FIG. 1) 



FIG. 2 



07/09/2003, EAST Version: 1.03.0002 



U.S. Patent May 15, 2001 Sheet 3 of 3 



US 6,233,338 Bl 



LINE 
11 



COMPOUND- 
ENCRYPTED - 
DATA 



DECRYPT KEY 
]^-270 



-230 



SUPERVISORY DECRYPTION 
MANAGER 



MEMORY ACCESS CONTROL 



220-i 220-i 220-k 



r 



260 



t_ 



DATA. 



150 



DECOP-i DECOP-j 



220-1 



r 



200 



220-2- 



220-N- 



DECRYPTION OPERATOR 


DATABASE 


- ADD 


DECRYPT OP 


ADD 


DECRYPT OP 


ADD 


DECRYPT OP 






ADD 


DECRYPT OP 



-210-1 

-210-2 



DECOP-k 



\ 



210-3 
210-N 



240 



WORKSTATION 



FIG. 3 



07/09/2003, EAST Version: 1.03.0002 



US 6,233,338 Bl 

1 2 

VIRTUAL ENCRYPTION SCHEME combines selected ones of plurality of different encryption 

COMBINING DIFFERENT ENCRYPTION operators stored in an encryption operator database into a 

OPERATORS INTO COMPOUND- compound sequence of encryption operators. Data to be 

ENCRYPTION MECHANISM transported from a data source site, such as a user 

5 workstation, to a destination or data recipient site, is sequen- 

Tbis is a continuation of Application Ser. No. 08/691, tially encrypted by performing a compound sequential data 

838, filed Aug. 1, 1996 now U.S. Pat. No. 5,933,501, issued flow through this sequence prior to transmission. 

Aug. 3, 1999. By 'virtual' encryption scheme is meant that the overall 

FIELD OF THE INVENTION 10 f™f il f * *™ * ot actually perform any 

10 encrypting of the data. Instead, it assembles selected ones of 

The present invention relates in general to data processing a plurality of true encryption mechanisms into a cascaded 

and communication systems, and is particularly directed to sequence of successively different encryption operators, 

a data communication access control mechanism for 6aCQ G f which operates on the data, to realize a scrambled 

enabling a computer end user to securely encrypt data d ata s t r eam that is not practically decryptable by a sophis- 

communications in such a manner that effectively prevents 15 Seated data communications usurper, 

a usurper from decrypting the data. For ±]s puiposCf a p i ura lity of respectively different data 

BACKGROUND OF THE INVENTION encryption operators are stored in an encryption algorithm 

™ . c .j . t * * # database, with each operator having an associated access 

The rapid expansion of the data communications industry, ' . . F \. u . & t , , n 

i i . , „, uwrj wTummmn address code through which the operator may be readily 

m particular the Internet and the World Wide Web (WWW), 20 m j j * . j * t 

v . , . lL . * . . . / , 7 zu called up or accessed to operate on a data sequence of 

sometimes referred to as the supennformation highway, has . 4 L. , . . . r . ftU . 

., . , . v ... J\ . rr interest The fundamental mechamsm of the virtual encryp- 

provided data processing system users with what is eftec- . , e JL , .. , 

" . , . , • »• t- i ■ 4 4 hon scheme of the invention involves the generation of a 

lively global communication link interconnecting a vast , . . .... . 

: r,,. , . ^ . i II- i sequence of the access codes, with immediately successive 

number of databases and other network users, lne local link e.u j c<u u- a a- *f 

, „ .l 4 i j 4U ■ . ■ ii u f ones of the access codes of the sequence being different trom 

between the network and the user is typically by way ot a 25 *u 

t_ 1. / 1 c \ \ c Li- one another, 
phone line (e.g., analog or ISDN, for example) of a public 

communication service provider, with the workstation hard- ^ access code 15 employed to caU up or read 

ware including a modem or terminal adapter equipment that out from ^ dalabase " lected ones of ^ ^pectively 

aUows dial-up access between the user and a remote party. differcnt data encryption operators so as to produce or 

Since a user's workstation is coupled directly to such 30 assemble a sequence of data encryption operators. Because 

interface equipment, not only can the workstation user immediately successive ones of the access codes of the 

access any other party having similar network access, but access code sequence are different from one another, then 

any other party can call the user's workstation. **ir associated data encryption operators that have been 

. . , t . „ t ... vir* assembled into the sequence of data encryption operators are 

More particularly, as diagrammatically illustrated m bl(j. . . . ..J 1 t c J t r ., , 4 

. r 1 i /• in 4- ■ 11 u 1 * „ also successively different from one another. When the data 

1, a user workstation 10 may typically be coupled via a 35 . * ■> c - j- -j 1 * 

' ■ 1 * 11 v. 1 /i AvniAu is apphed to the generated sequence of individual encrypting 

communication link 11 to a local area network (LAIN) 2U by , . . ti . . . , . , . 

, rAw, j 11 i_-ui -j 4 operators, what results is a scrambled data stream having no 

way of a LAN interlace 13, which also provides access to an r ... ,,. c . . . , . ° , 

J , ... .* . " m^c\ 4. 1 readily discernible encryption footprint that would imply 

external, public communication services (PCS) network, , . . . . , , . , f „-r. / 

A. 1 4 4i« t ivnn 4 -1 - 1 j what encryption mechanism has been used and facilitate 

such as the Internet 30. LAN 20 customarily includes one or , . 5 i_- < j j . • 

, , . . t , ... 3 . . . jn decryption by a sophisticated data communications usurper, 

more computer-based units, such as the illustrated works ta- 40 Ir } r r 

tions 21 and 22, network server 23 and printer 24, which are Smce 11 15 (yirtual • success of encryption operator 

interconnected via a hub 25. The bub 25 is connected to assembly mechanism of the invention does not rely upon the 

interface 13, so that the end user workstation 10 may access sophistication or complexity of any given encryption opera- 

any unit of the local area network 20. Similarly, to connect tor ils database. As a consequence, even conventional 

to the external network 30, the network interface 13 may be 45 encryption operators may be used. The key to the success of 

coupled through an electronic mail gateway 32 and a modem P resent mention is the fact that the data stream is 

33, so that a dial-up connection may be provided to an wrapped or encrypted multiple times prior to transmission, 

Internet connection provider 34, through which direct access ™ th each successive wrap of the data presenting an encryp- 

to the Internet 35 is achieved. tor ^at is different from the previous operator in the 

Because a public communication system is a potential 50 scc l ucncc - 

window into any computer linked to it, it is customary to lo ,ts sm P lest form ' me ^ encryption scheme of the 

both wrap or embed all communications in a 'security invention may comprise as few as two or three respectively 

blanket', (some form of encryption) at the source end, and dlffcrcnt encryption operators. The order of the encryptors 

to employ one or more permission code (password) layers ^n the sequence to which the data is applied may vary as 

that must be used to gain access to another computer. 55 desired, and the sequence may Moggie or switch back and 

Unfortunately, a fundamental characteristic of essentially forth between ^f™ ^ ^encryption operators as part of 

all encryption operators or algorithms is the fact that, given lts overaU encrv P tor Dow - 

enough resources, almost any encryption algorithm can be Because the encryption process of the invention subjects 
broken. This, coupled with the fact that each encryptioo ^e data to successively difference encryption operators, the 
algorithm has a 'footprint', which is discernible in the «> final output of the sequence will be a compound-encrypted 
scrambled data by a sophisticated data communications data stream ma t has no readily discernible encryption foot- 
analyst, means that no data communication can be guaran- P rim - As a consequence, even if a skilled data communica- 
teed as secure tions ^rper t0 possess a decryption key for each of 

the encryption operators of which the compound encrypted 

SUMMARY OF THE INVENTION 6S daU stream ^ comprised, there is a very low likelihood that 

In accordance with the present invention, this problem is he would be able to recognize the characteristics of any 

effectively remedied by a 'virtual' encryption scheme that individual encryption operator. Moreover, without knowl- 
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edge of the sequence of encryption operators through which improve signal- to-noise ratio (reduce bit error rate), or 

the data has been encrypted, a usurper will be forced to improve channel bandwidth occupancy. Encryption in the 

operate under a severe resource penalty that makes decryp- context of the present invention is an 'exterior* data flow 

lion of such a compound sequence a practical impossibility. operation to which an entire data stream, that has already 

a..u _ - - * j^r^ j.t. ™ , - r „ 5 been subjected to the above discussed 'interior' data pro- 

At the recipient end of the data communicator* path the ^ ^rations, is applied so as to scramble and thereby 

recovery process involves the use of a complementary reader \ n F mtclligible the ultimate data format that results 

virtual decryption scheme that is the exact reverse of that from sucfa prelirninarv data processing operations, 

used at the data source site. Namely, at the recipient site the Referrm qow tQ mQ ^ ^ ^ ^on of the 

received scrambled data stream is subjected to a virtual ^ tioa and decryption me chanism of the present 

decryptor, which sequentially unwraps using a decryption 10 ^ agrammaticaliv ilhlstrated ^ prising a 

key known to the recipient as bemg the complemen of the ^ ^ fa a ^ W0[ltstati mch 

encryptmg sequence, thereby recovering the original data. ^ ^ WQrkstation 10 m tbe system illuslrated ^ no. i, the 

BRIEF DESCRIPTION OF THE DRAWINGS <| atabase MO containfog a plurality of respectively ^different 

15 data encryption routine or operator entnes 110-1, 100-2, 

FIG. 1 diagrammatically illustrates a user workstation 100-3, . . 100-N. The encryption routines 110, in and of 

coupled to a local area network by way of a local area themselves, need not be any particular type of encryption 

network interface, which also provides access to an external algorithm and may be conventional encryption operators, 

network; such as, PGP, DES, etc. routines, as non-limiting examples. 

FIG. 2 diagrammatically illustrates a virtual encryption 20 E* 00 encryption operator 110-i has an associated access 

mechanism of the present invention; and address code 120-i, that is used by a memory access con- 

FIG. 3 diagrammatically illustrates a virtual decryption ^ of a ^P^isory encryption assembly manager 130 to 

mechanism of the present invention. <f U P or ret ? eve a "f***™ ™ C W h0n °?™ l0T U ° l m 

r the course of generating an encryption operator sequence 

DETAILED DESCRIPTION 25 mat °P erates on a data stream 150 to be transmitted. 

As described briefly above, the fundamental control factor 

Before describing in detail the improved data encryption used by the virtual encryption scheme of the invention is the 

mechanism in accordance with the present invention, it fact it pro d uce s a sequence 160 of access address codes 

should be observed that the present invention resides pri- ^-i, such mat immediately successive codes 120-i and 

marily in what is effectively a prescribed set of communi- 3Q ^-j m tne assembled code sequence are different from one 

cation encryption and decryption software employed by another. Thus, for an arbitrary plurality N of respectively 

digital data terminal and communication equipment, that different data encryption routine or operator entries 110-1, 

effectively enables end users of a data communications link \W-2, 100-3, . . 100-N, there will be N associated access 

to conduct secure data communications therebetween with- address codes 120-1, 120-2, 120-3, . . 120-N. 

out the practical possibility of successful recovery in an 3S , n accordancc ^nth me invention the supervisory encryp- 

mtercepted encrypted data. don j^mbiy manager 130 is supplied with an encryption 

Consequently, the configuration of data terminal and driver or key 170 comprised of a sequence of M access code 

communications units and the manner in which they are entries made up of K (at least two and up to all N) address 

interfaced with other communication equipment of a con- coc ] e entries 120 for the encryption operators 110 stored in 

ventional (public service) communications network have ^ the database 100. M may be any number equal to or greater 

been illustrated in the drawings by readily understandable than two. Thus, at a minimum, address code sequence 140 

block diagrams, which show only those specific details that . would be defined by only two respectively different ones 

are pertinent to the present invention, so as not to obscure the 120-i and 120-j of the N available codes, so that M would 

disclosure with details which will be readily apparent to be equal to two, regardless of N. Even if N is only two, M 

those skilled in the art having the benefit of the description 45 ^ SU U unbounded, since it may comprise an alternating 

herein. Thus, the block diagram illustrations of the Figures sequence of arbitrary length. Namely, where N-2, the 

are primarily intended to illustrate the major components of database -100 would have only two entries 120-1 and 120-2. 

the system in a convenient functional grouping, whereby the i n this case, an encryption control access code sequence of 

present invention may be more readily understood. length M could be generated as the alternating 

As described briefly above, the data processing scheme of 50 sequence . . .,120-1, 120-2, 120-1, 120-2, 120-1, 120-2, 

the present invention is effectively a 'virtual', encryption 120-1, 120-2, . . ., up to M entries, where M>2. What is 

and decryption scheme, as it does not actually perform any important is that the respective codes of any successive pair 

encrypting of tbe data, but rather assembles selected ones of of codes differ from one another. 

a plurality of true encryption mechanisms into a cascaded Given this successively different address code sequence 
sequence of successively different encryption operators. It is 55 140, to encrypt the data stream 150, the supervisory encryp- 
the individual operators of the assembly that operate on the tiorj assembly manager 130 initiates the encryption process 
data. Data that has been sequentially encrypted by the by calling up the first operator entry 110 associated with the 
individual encrypting operators of the virtual encryption first code 120 of the sequence 140 and applies tbe data 150 
scheme of the present invention is thus scrambled such that to that first encryption operator entry, so as to 'wrap' the data 
is not practically decryptable by a sophisticated data com- so with that encryption operator. The supervisory encryption 
munications usurper. then calls up the second operator entry 110 associated with 
Thus it is to be understood that the term encryption is not the second code 120 of the sequence 140 and applies the 
to be confused with other types of 'interior' or 'preliminary' initially wrapped data to the second first encryption operator 
data processing operations, such as code conversion, entry, so as to 'wrap' the previously encrypted data with the 
compression, the generation of a forward error correcting 65 next encryption operator. This successive process of access- 
checksum sequence that is appended to the data, or other ing sequentially differing encryption operators and wrapping 
types of signal processing mechanisms that are intended to the previously encrypted data continues until the last access 
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code in the encryption control sequence 140 is processed. 
The compound-encrypted data is then transmitted over com- 
munication path, such as the communication link 11 of the 
network of FIG. 1, to a local area network (LAN) 20 by way 
of a LAN interface 13, which also provides access to an 
external, public communication services (PCS) network, 
such as the Internet 30. 

To provide non-limiting illustration, let it be assumed that 
the encryption operator database 100 contains only three 
respectively different encryption operator entries 110A, 
HOB and HOC. As described above, an encryption operator 
sequence may be assembled using each of the three opera- 
tors as participants that are permuted into an arbitrary 
sequence, the length and composition of which is open 
ended. In the present example, it will be assumed that a total 
of five encryptions will be performed, using the five operator 
sequence: 110A-110B-110C-110A-110C. Thus, the encryp- 
tion driver or control key 170 supplied to the supervisory 
encryption assembly manager 130 will be comprised of the 
(M-5) code sequence: 120A-120B-120C-120A-120C 

In accordance with this non-limiting example, as the 
supervisory encryption assembly manager 130 processes 
this sequence, it will initially access the first encryption 
operator 110A associated with the first code 120A and cause 
the data 150 to be processed by the encrypting data flow 
operation embedded in the encryption operator 110A, pro- 
ducing a first 'A-encrypted' data stream. The supervisory 
encryption assembly manager 130 will next access the 
second encryption operator 110B associated with the second 
code 120B in the five code sequence 140 and cause the 
A-encrypted data to be processed by the encrypting data 
flow operation embedded in the second encryption operator 
HOB, producing a second, compound encryption of the 
original data stream as a B-encryption of the A-encrypted 
data. 

Next, supervisory encryption assembly manager 130 
accesses the third encryption operator 11 0C associated with 
the third code 120C in the five code sequence 140 and 
encrypts the B-encrypted, A-encrypted data producing a 
further compounded encryption of the original data 150 as a 
C-encryption of the B-encrypted, A-encrypted data. The 
C-encrypted, B-encrypted, A-encrypted data stream is next 
encrypted in accordance with the fourth operator 110A for 
the five code sequence 140, which is once again the 
A-encryption operator, as defined by the fourth access code 
120A, producing a more complex A-encryption of the 
C-encrypted, B-encrypted, A-encrypted data. Finally, the 
A-encrypted, C-encrypted, B-encrypted, A-encrypted data 
stream resulting from the first four, sequentially different 
encryption operators is encrypted in accordance with the 
fifth and last operator 120C associated with the five code 
sequence 140, producing a C-encryption of the A-encrypted, 
C-encrypted, B-encrypted, A-encrypted data, as an 
extremely complex encryption of the original data. 

From the foregoing, it will be readily appreciated that 
subjecting the data to successively different encryption 
operators will produce a compound-encrypted data stream 
having no readily discernible encryption footprint. 
Therefore, even if a skilled data communications usurper is 
in possession of a decryption key for each of the encryption 
operators A, B and C of which the five member compound 
encrypted data stream of the present example is comprised, 
there is a very low likelihood that he would be able to 
recognize the characteristics of any individual encryption 
operator in the transmitted data stream. In addition, without 
knowledge of the composition and entry order of the 
sequence of encryption operators through which the data has 
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been encrypted by the supervisory encryption assembly 
manager, a potential data communications interceptor will 
be forced to operate under such a severe resource penalty 
that decryption of such a compound encryption sequence is 

5 practically impossible. 

As described briefly above, at the recipient end of the data 
communications path, the recovery process involves the use 
of a complementary virtual decryption scheme that is the 
exact reverse of that used at the data source site. Thus, as 

10 shown in FIG. 3, for the foregoing example, at the recipient 
site, a supervisory decryption disassembly manager 230 
processes the received scrambled data stream using a 'vir- 
tual' decryptor, which 'unwraps' using a decryption code 
key 270 known to the recipient as being the reverse or 

15 complement of the encryption-control access code a 
sequence 140 at the source site. 

In accordance with the encryption operator sequence 
110A-110B-110C-110A-110C of the present example, to 
decrypt the received data stream the supervisory decryption 

20 disassembly manager 230 will execute a reverse decryption 
sequence 240 comprised of the decryption operators having 
the order C-A-C-B-A. For this purpose, using a decryption 
operator access code sequence 260, the memory access 
controller of the supervisory decryption manager 230 will 

2s generate a sequence of addresses 220 that sequentially call 
up a set of reverse ordered decryption operators 210C-210A- 
210C-210B-210A stored in a decryption operator database 
200. For the present example, it will initially generate an 
access code 220C associated with a first decryption operator 

30 210C of the set of decryption routines 210 stored in database 
200. This first accessed decryption operator 210C causes the 
received compound-encrypted data stream to be processed 
by the decrypting data flow operation embedded in the 
decryption operator 2 10C, thereby producing a first 

35 'C-decrypted' or partially 'unwrapped* data stream. 

Next, the second decryption operator 210A associated 
with the second code 220A in the five code decryption code 
sequence 260 causes the partially unwrapped, but still mul- 
tiply encrypted data stream to be processed by the decrypt - 

40 ing data flow operation embedded in the second decryption 
operator 210A, producing a second decryption or unwrap- 
ping of the received data stream. This decryption process is 
iteratively repeated, stepping through the remaining decryp- 
tion operators 210C, 210B and 210A of the five operator 

45 decryption sequence: 210C-210A-210C-210B-210A, so as 
to completely unwrap the received data stream, leaving the 
original data, plus whatever 'interior' or 'preliminary', data 
processing was imparted to the data at the source site, and 
requires further processing, separate and distinct from the 

50 decryption of the present invention. 

As will be appreciated from the foregoing description, by 
combining selected ones of a plurality of true encryption 
mechanisms into a cascaded sequence of successively dif- 
ferent encryption operators, the virtual encryption mecha- 

55 nism of the present invention is able to produce a scrambled 
data stream that is not practically decryptable by a sophis- 
ticated data communications interceptor, thereby effectively 
circumventing the inability of conventional data encryption 
schemes to provide a practical guarantee of security for data 

60 communications, while I have shown and described an 
embodiment in accordance with the present invention, it is 
to be understood that the same is not limited thereto but is 
susceptible to numerous changes and modifications as 
known to a person skilled in the art, and I therefore do not 

65 wish to be limited to the details shown and described herein, 
but intend to cover all such changes and modifications as are 
obvious to one of ordinary skill in the art. 
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What is claimed is: 

1. A method for controllably encrypting data to be trans- 
mitted over a communication path between a data source 
and a data recipient, comprising the steps of: 

(a) providing a plurality of respectively different data 5 
encryption operators each of which is capable of 
encrypting said data into an unintelligible form for 
transmission over said communication path; and 

(b) successively passing said data to be transported over 
said communication path through said plurality of 1 
respectively different encryption operators that are 
assembled in a cascaded sequence to produce a 
multiple-encrypted data stream. 

2. A method according to claim 1, wherein step (a) 
comprises storing said plurality of respectively different data 15 
encryption operators in an encryption operator database, and 
wherein step (b) comprises accessing respectively different 
ones of said plurality of respectively different data encryp- 
tion operators by means of a sequence of respectively 
different access codes, each of which is associated with a 20 
respectively different one of said data encryption operators, 
and successively passing said data to be transported over 
said communication path through respectively different 
accessed ones of said encryption operators to produce said 
multiple-encrypted data stream. 

3. A method according to claim 1, further including the 
steps of: 

(d) transporting said multiple-encrypted data stream over 
said communication path to said data recipient; and 3Q 

(e) passing said multiple -encrypted data data stream 
through a sequence of respectively different data 
decryption operators that respectively decrypt said 
multiple-encrypted data stream so as to recover said 
data. 35 

4. A system for controllably encrypting data to be trans- 
mitted over a communication path between a data source 
and a data recipient, comprising: 
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a database containing a plurality of respectively different 
data encryption operators; 

an access code generator which is operative to generate a 
cascaded sequence of access codes, immediately suc- 
cessive ones of which are different from one another, 
and each of which is associated with a respectively 
different one of said data encryption operators stored in 
said database; and 

a signal processor which is operative to controllably 
subject data to be transported over said communication 
path to a sequence of respectively different data encryp- 
tion operators accessed from said data based in accor- 
dance with a cascaded sequence of access codes gen- 
erated by said access code generator, so as to produce 
a compound-encrypted data stream. 

5. A system according to claim 4, further including: 

at said data recipient site, 

a data decryption operator database which stores a plu- 
rality of respectively different data decryption opera- 
tors; 

an address code generator which generates a sequence of 
access codes, each of which is associated with a respec- 
tive one of said data decryption operators stored in said 
data decryption database, and is operative to cause a 
sequence of data decryption operators to be accessed 
from said data decryption database in accordance with 
the reverse order of said sequence of data encryption 
operators that produced said compound-encrypted data 
stream; and 

a further signal processor which is operative to apply said 
compound-encrypted data stream that has been trans- 
ported over said communication path to said data 
recipient site through said sequence of data decryption 
operators accessed from said decryption operator data- 
base to recover said data. 

***** 



07/09/2003, EAST Version: 



1.03.0002 



